4 Commits

• feat(core): persist network approvals in execpolicy (#12357)

  ## Summary
  Persist network approval allow/deny decisions as `network_rule(...)`
  entries in execpolicy (not proxy config)
  
  It adds `network_rule` parsing + append support in `codex-execpolicy`,
  including `decision="prompt"` (parse-only; not compiled into proxy
  allow/deny lists)
  - compile execpolicy network rules into proxy allow/deny lists and
  update the live proxy state on approval
  - preserve requirements execpolicy `network_rule(...)` entries when
  merging with file-based execpolicy
  - reject broad wildcard hosts (for example `*`) for persisted
  `network_rule(...)`

  viyatb-oai · 2026-02-23 21:37:46 -08:00
  c3048ff90a
• fix(core) Deduplicate prefix_rules before appending (#10309)

  ## Summary
  We ideally shouldn't make it to this point in the first place, but if we
  do try to append a rule that already exists, we shouldn't append the
  same rule twice.
  
  ## Testing
  - [x] Added unit test for this case

  Dylan Hurd · 2026-02-01 20:30:38 -08:00
  6c22360bcb
• fix: policy/*.codexpolicy -> rules/*.rules (#7888)

  We decided that `*.rules` is a more fitting (and concise) file extension
  than `*.codexpolicy`, so we are changing the file extension for the
  "execpolicy" effort. We are also changing the subfolder of `$CODEX_HOME`
  from `policy` to `rules` to match.
  
  This PR updates the in-repo docs and we will update the public docs once
  the next CLI release goes out.
  
  Locally, I created `~/.codex/rules/default.rules` with the following
  contents:
  
  ```
  prefix_rule(pattern=["gh", "pr", "view"])
  ```
  
  And then I asked Codex to run:
  
  ```
  gh pr view 7888 --json title,body,comments
  ```
  
  and it was able to!

  Michael Bolin · 2025-12-11 14:46:00 -08:00
  e0d7ac51d3
• execpolicy helpers (#7032)

  this PR 
  - adds a helper function to amend `.codexpolicy` files with new prefix
  rules
  - adds a utility to `Policy` allowing prefix rules to be added to
  existing `Policy` structs
  
  both additions will be helpful as we thread codexpolicy into the TUI
  workflow

  zhao-oai · 2025-12-02 15:05:27 -05:00
  1d09ac89a1